Which action must Secunty Operations take when dealing with a known attack?

The correct answer is A. Document, monitor, and track the incident. The foundational Security Operations response to any known attack is to document, monitor, and track the incident. This follows standard incident response frameworks (NIST, SANS) where maintaining a complete record ensures accountability, supports forensic analysis, enables…

Submitted by diego_uy· Apr 18, 2026Security Operations (SOC)

Question

Options

ADocument, monitor, and track the incident.
BLimit the scope of who knows about the incident.
CIncrease the granularity of the application firewall.
DDisclose details of lhe attack in accordance with regulatory standards.

How the community answered

(30 responses)

A
93% (28)
C
3% (1)
D
3% (1)

Explanation

The foundational Security Operations response to any known attack is to document, monitor, and track the incident. This follows standard incident response frameworks (NIST, SANS) where maintaining a complete record ensures accountability, supports forensic analysis, enables lessons learned, and satisfies audit requirements. Limiting disclosure (B) may be situationally appropriate but is not the primary mandated action. Adjusting firewall granularity (C) is a possible remediation step but not a universal requirement. Disclosure (D) may be required by regulation but is a downstream activity, not the first action taken.

Topics

#Incident Response#Incident Management#Security Operations#Monitoring

Community Discussion

No community discussion yet for this question.

Full PCCET Practice